Jails improve on the concept of the traditional chroot environment in several ways. In a traditional chroot environment, processes are only limited in the part of the file system they can access.

learn more… | top users | synonyms

34
votes
1answer
1k views

I am going to chop the FreeBSD automounter into little pieces and boil them in oil

I am trying to expose a hierarchy of home directories to a number of FreeBSD jails. The home directories are configured such that each is a unique ZFS dataset. The jails are used for development ...
8
votes
1answer
4k views

SFTP: file symlinks in a jailed (chrooted) directory

I'm trying to set up sftp so that a few trusted people can access/edit/create some files. I have jailed a user into their home directory (/home/name) but have run into a problem. I want for them to ...
7
votes
3answers
4k views

use LXC under heavier virtualization (Xen, KVM,Hyper-V,VMVare)

Is it possible to use LXC under heavier virtualization (Xen DomU,KVM,Hyper-V,VMVare) ? I would like to use it as security (isolation) tool, the ability to limit resource consumption is not priority ...
7
votes
4answers
4k views

OpenSSH anything like 'internal-sftp' but for SCP?

I'm running Debian stable and I'm looking to establish the following environment for users in my 'sftponly' group: jailed can transfer with SFTP can transfer with SCP cannot login interactively with ...
6
votes
4answers
1k views

Difference between chroot and jail

I read this tutorial - https://help.ubuntu.com/community/BasicChroot - and what I understood is that, chroot is the process of changing the / while the new restricted environment created is the ...
6
votes
1answer
2k views

Is there a tool for managing FreeBSD jails that knows about ZFS?

ZFS under FreeBSD lets one assign filesystems to a jail, such that an account in the jail with the appropriate privileges can access the filesystem, create new subordinate filesystems, and so forth. ...
6
votes
1answer
1k views

FreeBSD Jail with Loopback IP, IPFW, and natd - Outbound connections fail from jail

I've got a FreeBSD 9.0 server. It has several jails, but they all have this same issue. They can not initiate connections to the outside world. They communicate with each other and the host fine. ...
4
votes
2answers
5k views

How to Create Jailed Users?

My servers run CentOS: Nginx + PHP-FPM (PHP via Fast-CGI). Every site is on its own VirtualHost. Currently both Nginx and PHP-FPM run under root. I know this is bad practice, and there is no reason ...
4
votes
4answers
3k views

It is fair to jail my SFTP users to their home directory?

roots. I'm running an Ubuntu 9.04 (home) Server on my LAN. I currently use it to store little web apps, photos, some subversion repository and stuff like that. My (few) users are friends of mine and I ...
4
votes
3answers
572 views

SFTP access akin to jailed shell

I have a question about creating a user with sort of jailed shell access (actually all is required of this user is an sftp access to one particular directory). Scenario is as follows - I have an ...
4
votes
3answers
2k views

set up a chrooted SFTP login with OpenSSH

How might I create an SFTP login for an untrusted user in which he can only access the files in his own home directory and not run any commands? The online tutorial OpenSSH SFTP chroot() with ...
4
votes
2answers
598 views

Migrate FreeBSD jail

I need to create a freebsd jail for web hosting, that will be frequently migrated between hosts. How feasible is it? Can I use domains instead of IPs? can I use wildcard IPs? I need this to ...
4
votes
1answer
741 views

Building NanoBSD inside a jail

I'm trying to setup a jail to enable building a NanoBSD image. It's actually a jail on top of a NanoBSD install. The problem I have is that I'm unable to mount the md device in order to do the 'build ...
3
votes
2answers
1k views

How to tell if a freebsd jail is up to date?

I've set up a "Service Jail" in FreeBSD 8.0 according to the FreeBSD Handbook (http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/jails-application.html). After upgrading the host to the latest ...
3
votes
0answers
639 views

SSH_ORIGINAL_COMMAND variable not getting set

I am working with two servers, both of which run FreeBSD 8.4-RELEASE-p1 and OpenSSH_6.1p1. Both servers' ssh_config files, located in /etc/ssh, are identical. Both servers are configured to allow ...
2
votes
4answers
3k views

Prevent rssh users from leaving their jail directories

I'm attempting to use rssh to jail users strictly to their /home/user/public_html dirctories. I got it to work where an account can SFTP into the system successfully on a test server, but once I login ...
2
votes
2answers
573 views

How to map authenticated Nginx users to their own directory?

I am writing a social networking site in C and serving it all up with Nginx. How can I make it so that authenticated users go to their own directory -ONLY- where a user-specific index.html resides. ...
2
votes
1answer
300 views

MySQL performance on FreeBSD after moving db files from /var

I was running out of space on /var so I moved my db dir to /usr and noticed a significate decrease in performance. In addition I noticed that performance is much slower as well under any Jailed ...
2
votes
1answer
742 views

Debian: ip/network changes within chroot/jail

I've Debian Squeeze running and setup a chroot environment (/jail) with debootstrap. As seen in a tutorial, I mounted the following: proc on /jail/proc type proc (rw) devpts on /jail/dev/pts type ...
2
votes
1answer
250 views

FreeBSD Jail Authentication and Commands

I have setup a jail on FreeBSD-8.2 following the manual. After the setup, I copied these files rc.conf, /etc/passwd from base to jail. And this is what I did in order: jexec id passwd (to change the ...
2
votes
1answer
1k views

sftp jail user. error in winscp

I have a configuration where specific users can log-in only in sftp and not ssh. Also the users are jailed in specific directories. Lets say the user name is stefanos and his rooted directory is ...
2
votes
3answers
467 views

Shared authentication across FreeBSD Jails

I am using FreeBSD with ZFS to run several jails. For jail management I'm using ezjail, and I have a template jail which I use for provisioning. I want to share passwd, groups, and authentication ...
2
votes
1answer
365 views

SFTP jail & Keeping file ownership the same / File owner per folder

I want to setup a jailed SFTP account for a subfolder of another user's home folder, but want the owner of everything in that subfolder to stay the same, including new files and folders uploaded and ...
2
votes
1answer
649 views

jailkit chroot terminates ssh login

I've done my very best to follow these instructions to create a chroot shell. But the connection get's terminated every time I try to login via ssh for my new chrooted user. I start my ssh terminal, ...
2
votes
0answers
65 views

Simplest & Easy Way To Jail Users

I Need Simplest & Easy Way To Jail Users in there home directories I am looking tools like " jailkit & MySecureShell " Or simple configuration to jailing users (with full help or some good ...
2
votes
1answer
242 views

Jail user to only read/write into their user directory

I'm running a Ubuntu server and wanted to know if there was a way to only allow a user (connecting via FTP and SSH) read and write access to their own /home/user/ directory and not let them read or ...
2
votes
1answer
451 views

What are the security implications of using allow.sysvipc in a FreeBSD jail

The man page for jail says that allow.sysvipc enables "System V primitives [to] share a single namespace across the host and jail environments..." thus "... processes within a jail would be able to ...
1
vote
1answer
74 views

Fail2ban jail.local vs jail.conf

Does jail.local file act as an override to jail.conf or as a replacement to jail.conf? When I was learning about Fail2Ban from tutorials, most of them usually say either to copy jail.conf to ...
1
vote
2answers
3k views

How to connect FreeBSD Jail to network

So recently I successfully installed and configured a freebsd jail and I would like to install software within my jail but I cannot connect to the network. I'm trying to setup an apache+php+mysql ...
1
vote
2answers
424 views

FreeBSD jails access

I want to run an application inside jail so that allowed uses can only connect to the jailed env (application) and nothing else on my box. But they need to be able to connect to the jail over the ...
1
vote
1answer
80 views

How do I symlink one directory to a chrooted (jailed) directory?

'm trying to create a folder (directory) for a jailed user on my server that will allow him to access another folder outside of his jail. I'm trying to do this with symlink but all it does is create a ...
1
vote
2answers
2k views

FreeBSD - Can't access jail from SSH

I need your help for solving an SSH+FreeBSD+jails authentication issue. I've (almost) successfully set up a jailed environment on my FreeBSD 8.2 box. My FreeBSD host has 2 network interfaces: ...
1
vote
1answer
222 views

Security implications of mount --bind in a chroot environment

Assume you have a chroot environment where you need a resource - an application or a library - which resides on the host (external to the chroot). Which are the security implications (if any) of ...
1
vote
1answer
2k views

SFTP - couldnt read packet: connection reset py peer

I have setup SFTP on our development box and would like to jail users into the /var/www/project folder I have added the following to /etc/ssh/sshd_config Match Group developers ChrootDirectory ...
1
vote
1answer
780 views

A jail that is accessible from network without port forwarding

I am using FreeBSD 7.1 and on my server I have two different jails. One for database and second one for game server. What I need to know is if it is possible to assign game server's jail to public IP ...
1
vote
0answers
199 views

Jail PHP to OpenBasedir or Document Root Debian

I have a VServer running with Debian Squeeze Debian Squeeze / Apache2 / FastCGI / MySQL / Froxlor. The administration of Customers, Domains and FTP Accounts are performed using Froxlor. Following ...
1
vote
1answer
628 views

Is it possible to run dhcpd3 as non-root user in a chroot jail?

I would like to run dhcpd3 from a chroot jail on Debian Lenny. At the moment, I can run it as root from my jail. Now I want to do this as non-root user (as "-u blah -t /path/to/jail" Bind option). ...
1
vote
2answers
141 views

System Security (PHP and others)

I have a few important documents that I keep owned by www-data (apache's user) in my /var/www/ folder. They have to be www-data because PHP will write to them at times. I also have users who access ...
0
votes
2answers
152 views

can I jail ssh for more that one directory?

I have working jail ssh to one directory. I would love to give r/w access for the jail ssh user to few directories. For example /tmp/user /home/user /srv/www/user is that possible?
0
votes
2answers
3k views

Restricting User Access in Debian Squeeze

I've been contemplating ways to restrict user access to their own directories, not allowing them to navigate above their own user directory. I'm using SFTP, and don't want to install regular FTP ...
0
votes
1answer
654 views

How can i acess a shell of a jail on FreeBSD?

I have access to a a previously set up FreeBSD box with a number of jails on it. One of the jails is an SQL server and does not have ssh enabled on it. How can i gain access to a shell on that sql ...
0
votes
1answer
204 views

Fail2ban MTA=Postfix Setting in Jail Config giving Error

In /etc/fail2ban/jail.local, when I have the MTA setting to Postfix, Fail2Ban is showing an error and is unable to start. [DEFAULT] ignoreip = 127.0.0.1/8 bantime = 1800 ...
0
votes
2answers
2k views

PF firewall issues with FTP inside FreeBSD jail

I have recently tried to set up jails on one of my FreeBSD servers, and I’m running into strange errors while trying to download FreeBSD packages via FTP. I have these rules in the PF firewall to ...
0
votes
1answer
59 views

How to keep jailed users from changing directory to parent dirs?

I've chroot users with chroot_local_user=YES chroot_list_enable=YES chroot_list_file=/etc/vsftpd.chroot_list and I'm the only user in the chroot_list file. Other users log in jailed but when they ...
0
votes
1answer
101 views

Changing WebServer to use BSD Jails

I'm thinking of changing my web server so that Apache (and all of django web apps) run inside of a jail rather then on my host machine. I want to make this change for two reasons, the first and ...
0
votes
2answers
590 views

chroot'ing Apache to prevent shell scripts?

Recently I'm being told that a user has my system 'shelled.' While there hasn't been any unusual activity or errors in Apache error log, etc.. I'd rather be safe than sorry. So: If I run chroot ...
0
votes
1answer
524 views

using ssh why do sftp directories need to be world readable?

I added the below to sshd_config, when i chmod 770 the user folder i get this error? Why? how can i make the folder only readable to the user or group? the owner currently is root and the group is ...
0
votes
3answers
724 views

Jail users in a directory

I have a vps running debian OS and would like to create user accounts on it. I want it so that when the user logs in with sftp, everything in var appears to be their home directory and they cannot ...
0
votes
1answer
45 views

ports in freebsd jail fetching but not updating

I've created a jail to host my webserver/blog, but when attempting to build any port, I consistently get the message "portsnap: Directory is not writable: /usr/ports". Attached is a screen capture ...
0
votes
0answers
341 views

SSH server in a FreeNAS jail is not accessible from the local network

I Have a FreeNAS (not sure which version - the one that uses FreeBSD 9.2) setup with a jail that I use for running various tasks. The jail has SSH service enabled in rc.conf, and I can also see the ...